oscerd opened a new pull request, #24542: URL: https://github.com/apache/camel/pull/24542
## What The remote-file consumers (`camel-file`, `camel-ftp`, `camel-smb`, `camel-mina-sftp`) and `camel-azure-files` constrain their local downloads to the configured local directory using a path-segment boundary check — the containment added in CAMEL-23765 and made boundary-aware in CAMEL-23868 (`GenericFileHelper.isWithinDirectory` / `jailToLocalWorkDirectory`). The Azure Storage Blob and DataLake consumers did not apply an equivalent check. When `fileDir` is configured, the local download target was built directly from the remote object name via `new File(fileDir, name)`, so a name containing `../` segments could resolve to a location outside `fileDir`. This change brings the two Azure Storage consumers in line with the rest of the file-download consumer family. ## How - New shared helper `AzureFileNameHelper.resolveWithinDirectory(fileDir, name)` in `camel-azure-common` (already a dependency of both storage modules). It resolves the name against `fileDir`, normalizes lexically, and verifies the result stays within `fileDir` on path-segment boundaries, throwing `IllegalArgumentException` otherwise. It uses only `java.nio.file`, so it adds no new dependency and does not depend on `camel-file`. - Wired into `BlobOperations.downloadBlobToFile` and `DataLakeFileOperations.downloadToFile`. ## Tests - `AzureFileNameHelperTest` — rejects parent/deep `../` traversal and a sibling directory that merely shares a name prefix (segment boundary, not string prefix); accepts simple/nested names and an internal `..` that normalizes back inside the directory. - `BlobOperationsTest` / `DataLakeFileOperationTest` — each asserts a `../`-bearing object name is rejected at the download call site. ## Notes - No public API or `@UriParam` changes; the full reactor build produced no regenerated catalog/DSL drift. Issue: https://issues.apache.org/jira/browse/CAMEL-23942 --- _Claude Code on behalf of oscerd_ 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
